CVE-2026-47721

{
  "id": "CVE-2026-47721",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T20:17:15.383",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2."
    },
    {
      "lang": "es",
      "value": "FUXA es un software de visualización de procesos (SCADA/HMI/Dashboard) basado en web. Antes de la 1.3.2, POST /API/scheduler y DELETE /API/scheduler en servidor/API/scheduler/index.js no aplican consistentemente authJwt.haveAdminPermission para los ajustes del programador. Un operador autenticado no administrador puede crear o modificar deviceActions que invocan onSetValue o onRunScript, o eliminar programaciones, obteniendo acceso a cambios en los valores de los dispositivos y a la ejecución de scripts de proyecto del lado del servidor normalmente reservada para administradores. Las acciones programadas y repetitivas pueden seguir cambiando puntos de ajuste de PLC, enclavamientos de seguridad, el estado del dispositivo o datos del proyecto después de que finalice la sesión del operador. Este problema se ha solucionado en la versión 1.3.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "frangoteam",
          "product": "FUXA",
          "versions": [
            {
              "version": "< 1.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T15:21:25.802999Z",
          "id": "CVE-2026-47721",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/pull/2345",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr",
      "source": "[email protected]"
    }
  ]
}